linux-cve-announce - CVE-2023-53183: btrfs: exit gracefully if reloc roots don't match

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025091556-CVE-2023-53183-b15d@gregkh>
Date: Mon, 15 Sep 2025 16:02:37 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53183: btrfs: exit gracefully if reloc roots don't match

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

btrfs: exit gracefully if reloc roots don't match

[BUG]
Syzbot reported a crash that an ASSERT() got triggered inside
prepare_to_merge().

[CAUSE]
The root cause of the triggered ASSERT() is we can have a race between
quota tree creation and relocation.

This leads us to create a duplicated quota tree in the
btrfs_read_fs_root() path, and since it's treated as fs tree, it would
have ROOT_SHAREABLE flag, causing us to create a reloc tree for it.

The bug itself is fixed by a dedicated patch for it, but this already
taught us the ASSERT() is not something straightforward for
developers.

[ENHANCEMENT]
Instead of using an ASSERT(), let's handle it gracefully and output
extra info about the mismatch reloc roots to help debug.

Also with the above ASSERT() removed, we can trigger ASSERT(0)s inside
merge_reloc_roots() later.
Also replace those ASSERT(0)s with WARN_ON()s.

The Linux kernel CVE team has assigned CVE-2023-53183 to this issue.

Affected and fixed versions
===========================

	Fixed in 5.15.127 with commit 69dd147de419b04d1d8d2ca67ef424cddd5b8fd5
	Fixed in 6.1.46 with commit 9d04716e36654275aea00fb93fc9b30b850925e7
	Fixed in 6.4.11 with commit a96b6519ac71583835cb46d74bc450de5a13877f
	Fixed in 6.5 with commit 05d7ce504545f7874529701664c90814ca645c5d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53183
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	fs/btrfs/relocation.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/69dd147de419b04d1d8d2ca67ef424cddd5b8fd5
	https://git.kernel.org/stable/c/9d04716e36654275aea00fb93fc9b30b850925e7
	https://git.kernel.org/stable/c/a96b6519ac71583835cb46d74bc450de5a13877f
	https://git.kernel.org/stable/c/05d7ce504545f7874529701664c90814ca645c5d